Last updated 29 October 2026. Written from what the code actually does.
There are no accounts, no passwords, no advertising and no cookies. Two outside services load on our pages: Cloudflare's page-view counter and Google Fonts (see below). We cannot read your files, because they are encrypted before they leave your device and the key is never sent to us. Short messages never reach a server at all.
The contents of your files or messages. Encryption happens on your device using AES-128-GCM. The relay stores ciphertext it has no key for.
The decryption key. It travels between your two devices as sound. It is not uploaded, not logged and not recoverable by us. If you lose it, so do we.
Messages under 120 bytes. Short text is encoded directly into the chirp. No upload happens, and no server is involved in any way.
When a file or a longer message is sent, the relay receives the encrypted blob, its size, and the file name in plain form. The name is not encrypted, so avoid putting anything sensitive in a file name.
Encrypted blobs are deleted the moment they are downloaded once, and in any case 5 minutes after the upload finishes (15 minutes in Persistent Mode). A scheduled job removes anything that slips through. There is no archive and no backup.
Like any web server, ours records requests: the IP address, the page requested, the browser's user agent, the referring page, the host name used, and the response time. These are used to understand traffic and to rate-limit abuse, and they live in our hosting provider's rolling log buffer rather than in a database we query.
We also keep anonymous counters, such as how many transfers happened. They contain no identifiers and cannot be traced to a person.
Cloudflare Web Analytics. Cloudflare, which sits in front of the site, adds a small script to each page that counts page views and load times. It sets no cookies and does not follow you across sites.
Google Fonts. Most pages load the Inter font from Google, so Google receives a font request that includes your IP address.
Neither one ever sees your files, your messages or the key.
Payments are handled entirely by Stripe. We never see or store your card details. Stripe holds your email address and payment record under its own privacy policy.
To unlock Pro you enter the email you paid with. We send it to Stripe to check for an active subscription, and we write a masked form of it to our logs, for example an***@example.com. We do not keep a customer list of our own.
The app uses the microphone only to listen for chirps, and only while you have listening switched on. Audio is decoded on the device and never recorded, stored or uploaded.
Files you receive are decrypted and saved on your phone, where they stay until you delete them. You can remove them at any time in Settings, or in the Files app under On My iPhone. Deleting the app removes them too. Your preferences are stored on the device and nowhere else.
The app contains no analytics and no third-party SDKs.
The key is sound, so anyone within earshot, or anything recording in the room, can capture it. chirpfile protects you from a remote attacker and from us. It does not protect you from someone standing next to you.
We hold no account and no profile to export or delete. For a Stripe payment record, contact us and we will pass the request on, or use Stripe's billing portal directly.
Questions about this policy: [email protected].